This vulnerability (CVE-2025-0879) in Shopside App is due to improper neutralization of input during web page generation, classified as CWE-79 (Cross-site Scripting). It allows an attacker with high privileges to execute arbitrary scripts in the context of the application. The issue affects versions prior to 17.02.2025. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and low impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided.

Successful exploitation could allow an attacker with high privileges to execute arbitrary scripts within the Shopside App environment, potentially leading to limited confidentiality, integrity, and availability impacts. However, the requirement for high privileges reduces the likelihood of exploitation by low-privileged users. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor vendor communications for updates. Given the high privilege requirement, restricting access to trusted users and applying principle of least privilege may reduce risk until a fix is released.